CAN is designed to be relatively simple and is often implemented between microcontrollers with very little processing power (that are busy doing stuff where timings are important), and is used to relay messages in real time. Adding some encryption and DoS protection would introduce too much complexity and given that it's just two wires shared by all controllers, I don't think DoS protection is even possible in this case (what are you going to do if a rogue device decides to flood the bus with garbage or continuously hold the data lines "high"?).
A partial solution would be to separate the network into multiple buses, like it's done in most (all?) cars, where a separate bus is used for critical elements, and gateways are used to relay specific messages between them. DoS on a single bus doesn't affect the other one.
It is indeed possible to reprogram the firmware of any controller :
There are even easy-to-use software and hardware for that. This particular screenshot shows a program capable of updating the firmware of engine controllers and instrument clusters, but I'm sure the same applies to all controllers, it's just that the demand for software capable of tampering with engine/instrument clusters is higher (for obvious reasons) than the ones capable of interacting with the airbag or ABS ones. I'm sure criminals are exploiting these flaws and it proves yet again that security by obscurity just doesn't work.
If you have the time to reverse-engineer the original firmware you can easily make your own malicious version, and all you need is 30 seconds of access to the car's CAN bus (via the diagnostic port) to install the new firmware. Of course, you can use the radio as an entry point (for example, by exploiting vulnerabilities in its MP3 decoding functions) to get onto the CAN bus and install malicious firmware on other controllers. The only security is obscurity of the protocol which decays over time.
Finally I don't think there is an efficient way of securing the CAN bus - encryption and authentication won't do much - it will indeed prevent intrusions on the bus (such as a rogue device connected to the diagnostic port) but won't prevent against compromising a device that's supposed to have access to the bus (like the radio) which would be the main entry point of an attacker.
About installing firmware, requiring a unique passphrase printed in the car's documents before any firmware can be installed is a good solution, it will prevent a compromised device on the bus from compromising other devices, while still allowing the legitimate owner of the car to tamper with the firmware if they want to (because having to pay 300€ and often more to the dealer to replace a lost key or reprogram an used controller is what I would call getting ripped off).